In the Linux kernel, a mismatch in the calculated allocation size for bytes controls in the SOF IPC4 topology caused the data structure behind scontrol->ipc_control_data to be incorrectly sized. This error could lead to a heap-based buffer overflow or memory corruption when the kernel processes control data that exceeds the originally allocated space. The impact is the potential compromise of kernel memory integrity, which could, in turn, allow privilege escalation or denial of service.

The vulnerability affects the Linux kernel, specifically when the SOF (Sound Open Firmware) IPC4 topology functionality is enabled. No specific kernel versions are listed, so all Linux kernels that include the affected code path may be impacted until the patch is applied.

The CVSS score is not provided, and the EPSS score is unavailable, so the inherent exploitation probability cannot be quantified from the CVE data. The vulnerability is not listed in the CISA KEV catalog. However, because the flaw involves a heap-based buffer overflow in kernel space, the potential for exploitation is considered high if an attacker can influence the data sent to the SOF IPC4 topology controls. No publicly documented exploit is referenced, but the lack of a mitigated status encourages preemptive patching.